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WE CLAIM: 

1. A method of determining autonomous system volume data comprising: 
collecting data flow statistics for at least one router; 

collecting routing information base data for each of the at least one router; and 
correlating the routing information base data and the data flow statistics, 
thereby yielding autonomous system volume data. 

2. The method of claim 1, further comprising, following the step of correlating: 
analyzing the autonomous system volume data, and 
reporting results of the step of analyzing. 

The method of claim 1, wherein the step of collecting the data flow statistics 
one router comprises: 

collecting the data flow statistics during a pre-determined time interval; and 
aggregating the data flow statistics by destination address. 

4. The method of claim 1, wherein the step of collecting the data flow statistics 
for the at least one router comprises using a data flow collection program. 

5. The method of claim 1, wherein the collected routing information base data 
for the at least one router comprises at least one selected autonomous system path. 

6. The method of claim 1, wherein the step of collecting the routing information 
base data for the at least one router comprises taking a snapshot of border gateway protocol 
data. 



3. 

for the at least 
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1 7. The method of claim 1 , wherein the step of correlating the routing information 

2 base data and the data flow statistics comprises: 

3 identifying a destination address in the data flow statistics; 

4 identifying a prefix corresponding to the destination address; 

5 identifying an autonomous system path corresponding to the prefix; 

6 correlating a data flow statistic corresponding to the destination address to 

7 each autonomous system included in the autonomous system path. 

1 8. The method of claim 1, wherein the step of correlating the routing information 
base data and the data flow statistics comprises: 

Hi identifying a destination address in the data flow statistics; and 

*J correlating a data flow statistic corresponding to the destination address to 

each autonomous system included in an autonomous system path corresponding to the 

u& 

??6 destination address. 

*** 

.w 

SI 9. The method of claim 1, wherein the step of correlating the routing information 

2 base data and the data flow statistics comprises correlating a data flow statistic corresponding 

3 to a destination address to each autonomous system included in an autonomous system path 

4 corresponding to the destination address. 

1 10. The method of claim 7, wherein the step of correlating the routing information 

2 base data and the data flow statistics comprises repeating the steps of claim 7 for each 

3 destination address of the data flow statistics of each of the at least one router. 
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1 11. The method of claim 8, wherein the step of correlating the routing information 

2 base data and the data flow statistics comprises repeating the steps of claim 8 for each 

3 destination address of the data flow statistics of each of the at least one router. 

1 12. The method of claim 9, wherein the step of correlating the routing information 

2 base data and the data flow statistics comprises repeating the steps of claim 9 for each 

3 destination address of the data flow statistics of each of the at least one router. 

1 13. The method of claim 1, further comprising: 

Ids 

lA computing at least one synthetic autonomous system path; and 

*8 reporting autonomous system volume data of the at least one synthetic autonomous 

5 'fx 

system path. 

■5#Sf 
2 : 

If J 14. A system for determining autonomous system volume data comprising: 

N£ a data flow collection node adapted to collect data flow statistics from at least 

u 

t*5 one router; 

4 a routing information base collection node adapted to periodically collect 

5 routing information base data from the at least one router; and 

6 a correlation node adapted to correlate the routing information base data and 

7 the data flow statistics and thereby yield autonomous system volume data. 

1 15. The system of claim 14, further comprising a reporting node adapted to 

2 analyze and report on the autonomous system volume data. 
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1 16. The system of claim 14, wherein the correlation node is adapted to: identify a 

2 destination address in the data flow statistics; 

3 identify a prefix corresponding to the destination address; 

4 identify an autonomous system path corresponding to the prefix; 

5 correlate a data flow statistic corresponding to the destination address to each 

6 autonomous system included in the autonomous system path. 

1 17. The system of claim 14, wherein the correlation node is adapted to: identify a 



ME destination address in the data flow statistics; and 

I** 

M 

correlate a data flow statistic corresponding to the destination address to each 

m 

% autonomous system included in an autonomous system path corresponding to the destination 



g| address. 

yi 18. The system of claim 14, wherein the correlation node is adapted to correlate a 

'2l data flow statistic corresponding to a destination address to each autonomous system included 

w ■ 

* 3 in an autonomous system path corresponding to the destination address. 

1 19. The system of claim 14, wherein at least two of the data flow collection node, 

2 the routing information base collection node, and the correlation node are the same node. 

1 20. The system of claim 14, wherein the data flow collection node, the routing 

2 information base collection node, and the correlation node are each a separate node. 

1 21. The system of claim 14, further comprising a reporting node adapted to report 

2 autonomous system volume data on at least one synthetic autonomous system path. 
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1 22. A method of generating autonomous system volume data comprising: 

2 detecting at least one first data flow having a first volume and directed toward 

3 a first destination address using a first selected autonomous path in a routing information 

4 base; and 

5 for each autonomous system in the first selected autonomous system path, 

6 incrementing a counter by an amount indicating the first volume. 

1 23. The method of claim 22, further comprising: 

|*2 detecting at least one second data flow having a second volume and directed 

Q toward a second destination address using a second selected autonomous system path in the 

Ms 

l f| routing information base; 

fj& for each autonomous system in the second selected autonomous system path, 

y? incrementing a counter by an amount indicating the second volume; and 
gy' wherein at least one autonomous system in the routing information base is 

|2B updated before the detecting of the at least one second data flow. 

1 24. The method of claim 22, further comprising: 

2 providing counter data resulting from the incrementing of the counter during a 

3 specified time period; 

4 analyzing the counter data; and 

5 reporting results of the step of analyzing. 
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1 25. A method of generating autonomous system volume data comprising: 

2 detecting at least one first data flow having a first volume and directed toward 

3 a first destination address; and 

4 for each autonomous system in a first synthetic autonomous system path, 

5 incrementing a counter by an amount indicating the first volume. 

1 26. The method of claim 25, further comprising: 

2 detecting at least one second data flow having a second volume and directed 
HB toward a second destination address; 

;- s 4 for each autonomous system in a second synthetic autonomous system path, 



*Jjp incrementing a counter by an amount indicating the second volume; and 

in 

t& wherein at least one autonomous system in a routing information base is 

%- 

M7 updated before the detecting of the at least one second data flow. 

.}-■:■■;■- 

3 27. The method of claim 25, further comprising: 

r 2 providing counter data resulting from the incrementing of the counter during a 

3 specified time period; 

4 analyzing the counter data; and 

5 reporting results of the step of analyzing. 
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28. A method of generating autonomous system volume data comprising: 
detecting at least one first data flow having a first volume and directed toward 

a first destination address using a first selected autonomous path in a routing information 
base; and 

for a terminating autonomous system in the first selected autonomous system 
path, incrementing a counter by an amount indicating the first volume. 

29. The method of claim 28, further comprising: 

detecting at least one second data flow having a second volume and directed 
toward a second destination address using a second selected autonomous path in the routing 
information base; 

for a terminating autonomous system in the second selected autonomous 
system path, incrementing a counter by an amount indicating the second volume; and 

wherein at least one autonomous system in the routing information base is 
updated before the detecting of the at least one second data flow. 

30. The method of claim 28, further comprising: 

providing counter data resulting from the incrementing of the counter during a 
specified time period; 

analyzing the counter data; and 
reporting results of the step of analyzing. 
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